Examples with PreAuthenticatedAuthenticationToken org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken used on opensource projects

Example 46 with PreAuthenticatedAuthenticationToken

use of org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken in project irida by phac-nml.

the class ProjectOwnerPermissionTest method testRemoteProjectWrongAuth.

@Test
public void testRemoteProjectWrongAuth() {
    project.setRemoteStatus(new RemoteStatus("http://somewhere", null));
    Authentication authentication = new PreAuthenticatedAuthenticationToken(user, user.getSystemRole());
    boolean customPermissionAllowed = permission.customPermissionAllowed(authentication, project);
    assertFalse("user should not be able to read project", customPermissionAllowed);
}

Example 47 with PreAuthenticatedAuthenticationToken

use of org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken in project irida by phac-nml.

the class ProjectOwnerPermissionTest method testLocalProject.

@Test
public void testLocalProject() {
    Authentication authentication = new PreAuthenticatedAuthenticationToken(user, user.getSystemRole());
    boolean customPermissionAllowed = permission.customPermissionAllowed(authentication, project);
    verify(userRepository).loadUserByUsername(user.getUsername());
    assertTrue("user should be able to read project", customPermissionAllowed);
}

Example 48 with PreAuthenticatedAuthenticationToken

use of org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken in project irida by phac-nml.

the class ProjectOwnerPermissionTest method testLocalProjectDenied.

@Test
public void testLocalProjectDenied() {
    User user2 = new User();
    user2.setUsername("bob");
    user2.setSystemRole(Role.ROLE_USER);
    when(userRepository.loadUserByUsername(user2.getUsername())).thenReturn(user2);
    Authentication authentication = new PreAuthenticatedAuthenticationToken(user2, user2.getSystemRole());
    boolean customPermissionAllowed = permission.customPermissionAllowed(authentication, project);
    verify(userRepository).loadUserByUsername(user2.getUsername());
    assertFalse("user should not be able to read project", customPermissionAllowed);
}

Example 49 with PreAuthenticatedAuthenticationToken

use of org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken in project irida by phac-nml.

the class RunAsUserAspect method setSecurityContextFromAnalysisSubmission.

/**
 * Advice around a method annotated with {@link RunAsUser}. This method will
 * set the {@link User} specified in the {@link RunAsUser#value()} using
 * SpEL in the security context before the method is run, then reset the
 * original user after the method completes.
 *
 * @param jp
 *            {@link ProceedingJoinPoint} for the called method
 * @param userAnnotation
 *            {@link RunAsUser} annotation specifying the user
 * @return Return value of the method called
 * @throws Throwable
 *             if the method throws an exception
 */
@Around(value = "execution(* *(..)) && @annotation(userAnnotation)")
public Object setSecurityContextFromAnalysisSubmission(ProceedingJoinPoint jp, RunAsUser userAnnotation) throws Throwable {
    // Get the method arguments and apply them to an evaluation context
    MethodSignature signature = (MethodSignature) jp.getSignature();
    String[] parameterNames = signature.getParameterNames();
    Object[] args = jp.getArgs();
    StandardEvaluationContext evaluationContext = new StandardEvaluationContext();
    for (int i = 0; i < args.length; i++) {
        String name = parameterNames[i];
        Object val = args[i];
        evaluationContext.setVariable(name, val);
    }
    // get the expression from the annotation and apply it to the evaluation
    // context
    String expression = userAnnotation.value();
    ExpressionParser parser = new SpelExpressionParser();
    Expression parseExpression = parser.parseExpression(expression);
    Object expressionValue = parseExpression.getValue(evaluationContext);
    if (!(expressionValue instanceof User)) {
        throw new IllegalArgumentException("RunAsUser value must refer to a User");
    }
    User submitter = (User) expressionValue;
    // get the original security context
    logger.trace("Updating user authentication");
    SecurityContext originalConext = SecurityContextHolder.getContext();
    logger.trace("Original user: " + originalConext.getAuthentication().getName());
    logger.trace("Setting user " + submitter.getUsername());
    Object returnValue = null;
    try {
        // set the new user authentication
        PreAuthenticatedAuthenticationToken submitterAuthenticationToken = new PreAuthenticatedAuthenticationToken(submitter, null, Lists.newArrayList(submitter.getSystemRole()));
        SecurityContext newContext = SecurityContextHolder.createEmptyContext();
        newContext.setAuthentication(submitterAuthenticationToken);
        SecurityContextHolder.setContext(newContext);
        // run the method
        returnValue = jp.proceed();
    } finally {
        // return the old authentication
        logger.trace("Resetting authentication to " + originalConext.getAuthentication().getName());
        SecurityContextHolder.setContext(originalConext);
    }
    return returnValue;
}

Example 50 with PreAuthenticatedAuthenticationToken

use of org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken in project syndesis by syndesisio.

the class UserHandlerTest method successfulWhoAmI.

@Test
public void successfulWhoAmI() {
    openShiftServer.expect().get().withPath("/oapi/v1/users/~").andReturn(200, new UserBuilder().withFullName("Test User").withNewMetadata().withName("testuser").and().build()).once();
    SecurityContextHolder.getContext().setAuthentication(new PreAuthenticatedAuthenticationToken("testuser", "doesn'tmatter"));
    UserHandler userHandler = new UserHandler(null, new OpenShiftServiceImpl(openShiftServer.getOpenshiftClient(), null));
    User user = userHandler.whoAmI();
    Assertions.assertThat(user).isNotNull();
    Assertions.assertThat(user.getUsername()).isEqualTo("testuser");
    Assertions.assertThat(user.getFullName()).isNotEmpty().hasValue("Test User");
}